Observability and Logs

Audit Logs

Audit Logs provide a log of events across your organization, such as creating/deleting a repository or modifications to repository settings/configuration.

Audit Logs

Key Concepts

Clicking on a row in your audit log will expand to show more details.

Expanded log entry

Each entry in the log represents an event or a state change and consists of four main components.

  • Actor: The object that performed the Action, such as a User, Service Account or System
  • Verb: The verb (phrase) identifying "what_happened", such as login, retention_settings_changed or token_created
  • Action Object: The object which was created, deleted or updated by the action.
  • Target: (Optional) The object within which the Action was performed, such as a repository or account

Searching / Filtering

You can Search and Filter the Audit Log using the search box at the top. You can also use boolean logic (e.g. AND/OR/NOT) for complex search queries.

Search Terms

Search BySearch Terms Example
Actoractor:some-user
Actor Kindactor_kind:user (user)
actor_kind:service_account (service account)
actor_kind:system
Event Timeevent_at:>"1 day ago"
event_at:<"June 21, 2022 EST"
Event Kindevent_kind:action (action)
event_kind:create (create)
event_kind:read (read)
event_kind:update (update)
event_kind:delete (delete)
Event (Fuzzy)event:api_key (api key events)
event:entitlement (entitlement events)
event:login (login events)
event:package (package events)
event:retention (retention events)
event:service_account (service account events)

Field type modifiers (depending on the type, you can influence behaviour)

  • For all queries, you can use:
    ~foo for negation

  • For string queries, you can use:
    ^foo to anchor to start of term
    foo$ to anchor to end of term
    foo*bar for fuzzy matching

  • For number/date queries, you can use:
    >foo for values greater than
    >=foo for values greater / equal
    <foo for values less than
    <=foo for values less / equal

🔐 Audit Log Event Types (User and Organization)

Cloudsmith tracks a wide range of user and organization-level activities. The following audit events help you monitor security, access control, policy enforcement, and team collaboration across your organization.

EventIdentifierDescriptionContent Type
API Token Refresheduser.api_token.refreshedA user refreshed their API token.User
API Token Refresh Enforceduser.api_token.enforced_refreshAn API token refresh was enforced.User
API Token Expiry Notifieduser.api_token.expiring_soonUser notified of upcoming API token expiration.User
API Token Expired Notifieduser.api_token.expiredUser notified that their API token has expired.User
Password Updateduser.password.updatedUser password was updated.User
User Loginuser.loginUser successfully logged in.User
Service Createduser.service.createdCreated a new service user.User
Service Deleteduser.service.deletedDeleted a service user.User
Service Key Refresheduser.service.key_refreshedRefreshed the key for a service user.User
User Deactivateduser.deletedA user account was deactivated.User
User Restoreduser.restoredA previously deactivated user account was restored.User
Member Invitedorg.invite.invitedInvited a new member to the organization.Org
Invitation Canceledorg.invite.canceledCanceled an organization invitation.Org
Invitation Extendedorg.invite.extendedExtended an existing invitation.Org
Invitation Acceptedorg.invite.acceptedA user accepted an organization invitation.Org
Member Addedorg.member.addedA user was added to the organization.Org
Member Removedorg.member.removedA user was removed from the organization.Org
OIDC Settings Createdorg.oidc.createdCreated OpenID Connect (OIDC) settings.Org
OIDC Settings Updatedorg.oidc.updatedUpdated OIDC settings.Org
OIDC Settings Deletedorg.oidc.deletedDeleted OIDC settings.Org
Organization Deletedorg.deletedDeleted an organization.Org
Organization Renamedorg.renamedRenamed an organization.Org
Repo Creation Enabledorg.create_repos_enabledEnabled repository creation in the organization.Org
Repo Creation Disabledorg.create_repos_disabledDisabled repository creation.Org
Team Creation Enabledorg.create_teams_enabledEnabled creation of new teams.Org
Team Creation Disabledorg.create_teams_disabledDisabled creation of new teams.Org
Invite Collaborators Enabledorg.invite_collaborators_enabledEnabled collaborator invites.Org
Invite Collaborators Disabledorg.invite_collaborators_disabledDisabled collaborator invites.Org
Invite Users Enabledorg.invite_users_enabledEnabled user invites.Org
Invite Users Disabledorg.invite_users_disabledDisabled user invites.Org
Unredacted Email View Enabledorg.view_unredacted_members_enabledEnabled viewing member emails without redaction.Org
Unredacted Email View Disabledorg.view_unredacted_members_disabledDisabled viewing member emails without redaction.Org
SCIM Provisioning Allowedorg.scim_allowedAllowed SCIM provisioning.Org
SCIM Provisioning Blockedorg.scim_blockedBlocked SCIM provisioning.Org
SAML Login Enabledorg.saml_enabledEnabled SAML-based login.Org
SAML Login Disabledorg.saml_disabledDisabled SAML-based login.Org
SAML Enforce Enabledorg.saml_enforce_enabledEnforced SAML login for all users.Org
SAML Enforce Disabledorg.saml_enforce_disabledDisabled SAML enforcement.Org
SAML Group Sync Enabledorg.saml_group_sync_enabledEnabled SAML group synchronization.Org
SAML Group Sync Disabledorg.saml_group_sync_disabledDisabled SAML group synchronization.Org
Enforce 2FA Enabledorg.enforce_2fa_enabledEnforced Two-Factor Authentication.Org
Enforce 2FA Disabledorg.enforce_2fa_disabledDisabled 2FA enforcement.Org
License Policy Createdorg.policy.license.createdCreated a package license policy.Org
License Policy Updatedorg.policy.license.updatedUpdated a package license policy.Org
License Policy Deletedorg.policy.license.deletedDeleted a package license policy.Org
Vulnerability Policy Createdorg.policy.vulnerability.createdCreated a vulnerability policy.Org
Vulnerability Policy Updatedorg.policy.vulnerability.updatedUpdated a vulnerability policy.Org
Vulnerability Policy Deletedorg.policy.vulnerability.deletedDeleted a vulnerability policy.Org
API Key Policy Createdorg.policy.api.policy_createdCreated an API key policy.Org
API Key Policy Deletedorg.policy.api.policy_deletedDeleted an API key policy.Org
API Key Auto-Refresh Enabledorg.policy.api.enforce_refresh_enabledEnabled automatic API key refresh.Org
API Key Auto-Refresh Disabledorg.policy.api.enforce_refresh_disabledDisabled automatic API key refresh.Org
API Key Max Age Updatedorg.policy.api.max_age_changedChanged maximum allowed API key age.Org
Package Deny Policy Createdorg.policy.deny.createdCreated a package deny policy.Org
Package Deny Policy Updated (Name)org.policy.deny.name_updatedUpdated deny policy name.Org
Package Deny Policy Updated (Desc)org.policy.deny.description_updatedUpdated deny policy description.Org
Package Deny Policy Updated (Query)org.policy.deny.query_updatedUpdated deny policy query.Org
Package Deny Policy Enabledorg.policy.deny.enabledEnabled a deny policy.Org
Package Deny Policy Disabledorg.policy.deny.disabledDisabled a deny policy.Org
Package Deny Policy Deletedorg.policy.deny.deletedDeleted a deny policy.Org
Team Createdorg.team.createdCreated a team.Org
Team Deletedorg.team.deletedDeleted a team.Org
Team Renamedorg.team.renamedRenamed a team.Org
Team Slug Renamedorg.team.renamed_slugChanged the team’s slug.Org
Added to Teamorg.team.member_addedAdded a user to a team.Org
Removed from Teamorg.team.member_removedRemoved a user from a team.Org
Team Role Changedorg.team.role_changedUpdated a team member’s role.Org

🔐 Audit Log Event Types (Repository)

The following events are logged for repository-level actions, including package changes, key management, entitlement tokens, retention rules, and more.

EventIdentifierDescriptionContent Type
Repository Createdrepo.createdCreated a new repository.Repo
Repository Deletedrepo.deletedDeleted a repository.Repo
EULA Enforcement Enabledrepo.eula_enforcement_enabledEnabled EULA enforcement on a repository.Repo
EULA Enforcement Disabledrepo.eula_enforcement_disabledDisabled EULA enforcement on a repository.Repo
Retention Rules Enabledrepo.retention_enabledEnabled retention rules on a repository.Repo
Retention Rules Disabledrepo.retention_disabledDisabled retention rules on a repository.Repo
Retention Days Updatedrepo.retention_days_updatedUpdated 'limit by days' rule for retention.Repo
Retention Count Updatedrepo.retention_count_limit_updatedUpdated 'limit by count' rule for retention.Repo
Retention Size Updatedrepo.retention_size_limit_updatedUpdated 'limit by size' rule for retention.Repo
Retention Group by Name Updatedrepo.retention_group_by_name_updatedUpdated retention rule to group by package name.Repo
Retention Group by Format Updatedrepo.retention_group_by_backend_updatedUpdated retention rule to group by package format.Repo
Retention Group by Type Updatedrepo.retention_group_by_type_updatedUpdated retention rule to group by package type.Repo
Storage Region Updatedrepo.storage_region_updatedChanged the storage region of a repository.Repo
Verify Signatures Enabledrepo.verify_signatures_enabledEnabled signature verification for packages.Repo
Verify Signatures Disabledrepo.verify_signatures_disabledDisabled signature verification for packages.Repo
Entitlement Tokens Syncedrepo.token_syncedSynced entitlement tokens for the repository.Repo
Cache Rule Createdrepo.edge_cache.createdCreated a new edge cache rule.Repo
Cache Rule Deletedrepo.edge_cache.deletedDeleted an edge cache rule.Repo
Cache Metadata TTL Updatedrepo.edge_cache.dynamic_ttl_updatedUpdated metadata TTL for edge caching.Repo
Cache Storage TTL Updatedrepo.edge_cache.storage_ttl_updatedUpdated package TTL for edge caching.Repo
Entitlement Token Createdrepo.entitlement.createdCreated an entitlement token.Repo
Entitlement Token Deletedrepo.entitlement.deletedDeleted an entitlement token.Repo
Entitlement Token Enabledrepo.entitlement.enabledEnabled an entitlement token.Repo
Entitlement Token Disabledrepo.entitlement.disabledDisabled an entitlement token.Repo
Entitlement Token Secret Updatedrepo.entitlement.secret_updatedUpdated the secret for an entitlement token.Repo
EULA Revision Createdrepo.eula.createdCreated a new EULA revision.Repo
EULA Revision Deletedrepo.eula.deletedDeleted a EULA revision.Repo
EULA Content Updatedrepo.eula.content_updatedUpdated the content of a EULA revision.Repo
EULA Identifier Updatedrepo.eula.identifier_updatedUpdated the identifier of a EULA revision.Repo
GPG Key Createdrepo.gpg_key.createdCreated a GPG key for the repository.Repo
GPG Key Deletedrepo.gpg_key.deletedDeleted a GPG key from the repository.Repo
GPG Key Enabledrepo.gpg_key.enabledEnabled a GPG key.Repo
GPG Key Disabledrepo.gpg_key.disabledDisabled a GPG key.Repo
GPG Key Set as Defaultrepo.gpg_key.updated_defaultSet a GPG key as the default for signing.Repo
RSA Key Createdrepo.rsa_key.createdCreated an RSA key for the repository.Repo
RSA Key Deletedrepo.rsa_key.deletedDeleted an RSA key from the repository.Repo
RSA Key Enabledrepo.rsa_key.enabledEnabled an RSA key.Repo
RSA Key Disabledrepo.rsa_key.disabledDisabled an RSA key.Repo
RSA Key Set as Defaultrepo.rsa_key.updated_defaultSet an RSA key as the default for signing.Repo
Signature Key Createdrepo.signature_key.createdCreated a signature key.Repo
Signature Key Deletedrepo.signature_key.deletedDeleted a signature key.Repo
Signature Key Type Changedrepo.signature_key.type_changedChanged the type of a repository signature key.Repo